# Create a webhook subscription (https://terac.com/docs/developers/reference/createWebhookSubscription)

`POST https://terac.com/api/external/v2/hooks/subscriptions`

Creates a webhook subscription for one target URL and returns its signing secret. Created unconfirmed, so it receives nothing until you call the confirm endpoint and Terac's ping to target_url returns 2xx. A URL that already has a subscription returns 409; patch that one's event_types instead.

## Authorization

Requires a Bearer token via the `Authorization` header.

```
Authorization: Bearer <token>
```

## Request Body (required)

`Content-Type: application/json`

- `target_url` (string) **(required)**: A public https URL that answers 2xx. Private, loopback, link-local and internal addresses are refused, because confirming makes Terac issue a request to it. One subscription per URL; add event types to the existing one rather than creating a second. Confirm the subscription before it receives anything.
- `event_types` (array) **(required)**: Which events this URL receives. Read GET /hooks/event-types/ for the current list.
  - values: `submission.status.change`, `submission.approved`

## Responses

### 200: The unconfirmed subscription, with its signing secret in full.

- `id` (string) **(required)**
- `target_url` (string) **(required)**
- `event_types` (array) **(required)**: Every event type this endpoint receives. PATCH replaces the whole list.
  - values: `submission.status.change`, `submission.approved`
- `is_enabled` (boolean) **(required)**
- `confirmed_at` (string, nullable) **(required)**: When this subscription passed the confirmation ping. Null means it receives nothing yet.
- `disabled_at` (string, nullable) **(required)**
- `disabled_reason` (string, nullable) **(required)**: Set when Terac disabled the subscription rather than you, after sustained delivery failure.
- `created_at` (string) **(required)**
- `updated_at` (string) **(required)**
- `secret` (string) **(required)**: The signing secret in full, returned here and by the rotate call only. Store it now; you can also read it back from GET /hooks/subscriptions/{id}/secret.
### 400: Invalid input data

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**
### 401: The API key is missing, invalid, disabled, expired or revoked, its owner no longer exists, or it is not linked to an organization. The body is nested under `error`.

- `error` (object) **(required)**
  - `code` (string) **(required)**: one of: `UNAUTHORIZED`: The error code.
  - `message` (string) **(required)**: What went wrong.
### 403: Either the account that owns the API key is banned or deleted (from the key check, nested under `error`), or the key's owner lacks the organization permission this operation needs (from the operation, with `code` and `message` at the top level).

- One of: API key error (403)
  - `error` (object) **(required)**
    - `code` (string) **(required)**: one of: `FORBIDDEN`: The error code.
    - `message` (string) **(required)**: What went wrong.
- One of: Insufficient access error (403)
  - `message` (string) **(required)**: The error message
  - `code` (string) **(required)**: The error code
  - `issues` (array): An array of issues that were responsible for the error
    - `message` (string) **(required)**
### 429: The API key is rate limited. A key accepts 100 requests, then refuses every request until more than 60 seconds pass with no accepted request; refused requests do not extend the wait. Wait the number of seconds in `Retry-After`, then retry. The body is nested under `error`.

- `error` (object) **(required)**
  - `code` (string) **(required)**: one of: `RATE_LIMITED`: The error code.
  - `message` (string) **(required)**: What went wrong.
### 500: Internal server error

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**